I posted this yesterday to my blog and THOUGHT I also posted it here last night. It seems to have vanished so I am re-posting. I don't think it got deleted because Jason asked me to post it here:) One of those mysteries on the net, but hopefully it will go into the ether this time:)

If you are in the IT field, you have suffered extreme tortue by probably having to go to a few lectures or conferences on security. A dreary subject made all the worse by speakers who want to talk the *theories* of secured computing and a bunch of blah. Or vendor propaganda. This won't be near as dull, I promise!

Security for your home computer(s) is generally an afterthought until a nightmare happens to some unfortunate person you know or yourself. Then, it is suddenly a SERIOUS consideration, after the fact! Let's try and stop big-time problems before you have to learn the hard way.

Viruses? You should be so lucky! Everyone gets hyper about viruses but they generally just cause hours of headaches or a re-install at the worst. How about something that doesn't wipe-out your data, but instead steals it and your bank account and your financial life gets hijacked? I'm talking the worst threat out there, KEYSTROKE LOGGERS.

These little progs run invisible to you and don't cause an effect on your PC experience like crappy adware and malware. They can be directly installed on to your PC by someone else like your Dad or the IT geeks at work to monitor everything you do 24/7. Checking that bank acct at work? How about doing a little Yahoo mail to your mistress? Good chance that pimply dork known as the *network technician* is laughing his ass off at your private indiscretions or $2.87 bank balance. He's got your logins and passwords and he might decide to embarass you one day or even blackmail your ass. Say you're not that stupid to do this? Well, consider yourself one of the few. I have a keystroke logger in a corporation of a couple of hundred PCs and the employees of this corp have signed a statement acknowledging that those PCs are for WORK primarily and they ARE monitored. Plenty of employees still just do whatever the hell they feel like, seemingly oblivious to the fact they are monitored. A few got fired for spending 7.9 hours out of 8 watching porn streams and it took only about a week before married clowns are back sending emails to their action on the side or checking their bank accts. Duh!
So, unless you're the whole IT at where you work, forget about doing things with your ecurrencies or bank accts or anything you wouldn't want someone else having their hands on! Think your company is too small and no one there knows crap about computers so they aren't monitoring? Think again! I've put keystroke loggers on plenty of Mom and Pop style small businesses and showed them how to read the daily reports! I have seen my *efforts* I was paid for bring down people ranging from accounting temps to CEO's making mid-six figures to public officials like sheriffs and govt officials. DON'T BE STUPID!

OK, we got the #1 area where you can get seriously hosed at-your workplace-out of the way. Ignore the above at your own risk, Mr. or Mrs. It-Only-Happens-To-Other-Idiots! Let's secure your home PCs since that is the ONLY place you'll be doing anything financially or private, RIGHT? I thought so.

We are going to assume you are using Windows XP. Don't tell me about that stupid old saying about what *ass-u-me* really means. I ASSUME your intelligent enough to realize that around 90% of peeps out there are using Windows and that version would be XP. Mac and linux users, you know you have to use Windoze at times whether you want to or not so just shut up and listen for a while:)

You ARE using XP with Service Pack 2, RIGHT? You have Automatic Updates turned ON, RIGHT?Unless you have a funky custom application you use, get SP2. It's free. Contrary to what you may read, almost everyone who uses the standard stuff benefits from SP2 over not having it. I have installed SP2 on several thousand PCs since it came out in production, serious-as- hell-can't-go-down environments. Get it already! OK, maybe it won't run your 15 year old copy of WordPerfect for DOS. Move on.

1. If you are using IE as your main web browser, WHY? Do you enjoy all the bugs and serious security problems/updates? Get the Firefox browser (similar to IE) that is more secure, easier and better:
http://www.mozilla.org/products/firefox/
It has an option to automatically check for updates Think that might be something you would want to do? Hell yes! Even this much more secure browser will have holes discovered and upgrades so make sure you are using the latest and greatest, not something that three months had a problem.

2. Never go online without some sort of proxy. Proxies are a *middleman* between your PC and the big bad Internet. This goes *double* if you are browsing a lot of hyip or doubler sites. You trust those kind of admins with your information? I don't. One of the most popular options is the Metropipe tunnel (VERY secure - no one can see you at all). Metropipe is more then a proxy, its a tunnel...nothing in and nothing out of the secure tunnel.
http://metropipe.net
Easily configured to use with Firefox. Not that hard with IE if you follow instructions.
There are plenty of others that aren't expensive services. Stay away from the *free anonymous proxy servers* How do you know they are anonymous? How do you know they aren't what is called a *honeypot* that someone is using to gather your information(passwords people, passwords)from? Don't get cheap here. For $10 or less a month, you knock-out one huge privacy problem.

3. Use an encrypted(scrambled as opposed to plain old text anyone can read) and/or anonymous paid email service:
http://mailvault.com- free last I checked
http://www.safe-mail.net- same as above
http://katzglobal.net- not free but cheapo
This is getting real serious about security now! If you are doing the hanky-panky with your neighbor and you're married, this is a MUST. Don't leave evidence or your IP address around that is a great trail right back to you and your PC.

4. Get and use Roboform. It encrypts your ids and passwords so that if you got a keylogger, you are still protected! As a lot of keyloggers are accidently downloaded from websites, you might get one through your defenses. RoboForm or ShortKeys protects you even if you are infected.
http://roboform.com
They have a free trial version and I think u can use it with 10 logins/passwords forever. Excellent!

5. Firewall! If you are using DSL or broadband, you might not be aware that your router(that box that your connections go into) has a built-in firewall. It is not much to speak of but better than nothing if you use it. Make sure you pay attention to the instructions that came with your router about CHANGING THE DEFAULT PASSWORD!
Sorry, but leaving it as *admin* or *linksys* is an open-door to trouble.

Windows XP SP2 has a firewall. It's made by Microsoft so it's a half-ass firewall. If you don't like Windows constantly chiding you about not having it on, turn it *on* Some firewalls don't work with it *on* so you will need to read the instructions that come with the firewall you are going to get to better your security! Running two firewalls at the same time is usually a problem, BUT not a problem with

Agnitum! Excellent firewall and it will also run with XP's still on.
http://agnitum.com

Norton's or Macafee's firewalls? Don't get me started on how weak they are. ZoneAlarm is free and likely better than those two, but not near the toughness of Agnitum.

6. I use AVG anti virus. They have a free version.
http://www.grisoft.com/us/us_index.php
Let's put it this way: ANY antivirus is better than none. Most are about the same JUST KEEP THEM UPDATED! Stay away from *all-in-one* solutions that combine firewall, antivirus, spyware,etc. They may be simple and easy but don't cut it when you are surfing the dangerous wilds of doubler and hyip admins and using ecurrencies that people love to steal.

7. Spyware/malware/keystroke loggers/hijackers.
Too many to list. AdAware and Spybot are two real popular and free ones. I am probably the only dude that thinks that Webroot's SpySweeper is a clunker. As far as the paid ones, it is very popular but I find it to be very slow and misses too much. If you want to pay and get industrial-strength on spyware's sorry asses, go with Computer Associates' PestPatrol. For $30, it's worth it. Whether you are going the free or paid route, KEEP THEM UPDATED!

Last thing and this should be obvious: don't use the same login and password for progs you are in, gold accts, bank accts, etc.! Don't let a BAD THING like one login and password getting compromised turn out to be ALL your logins and passwords compromised! You got RoboForm now, you don't have to write down or remember this stuff!

How do you protect yourself from a stealin' egold or intgold employee on the inside from taking your money? Sorry, but that's always a possibility so make sure you don't let ecurrency linger in your accts. Get it the hell out of there ASAP!

Whew, security is a serious topic with a lot of areas to cover! I may have to charge *double* for this column. I hope you noticed one recurring theme here and that is whatever you have and use, KEEP IT UPDATED! New bad stuff appears daily and something a week out of date doesn't get the job done.

Do the above and you seriously will mimimize the chances of your egold acct getting emptied or someone deciding they would like to use your identity to open numerous credit card accts and buy some plasma TVs. And when your friends' ask about how secure it is to use a credit card on the net, ask them how secure is it to give your cc to some teenager in a restaurant or a convenience store clerk? Life is full of security risks, you just have to decrease the risks as much as realistically possible and accept that it will never be 100% fool-proof. It takes technology *experts* 6 hours of lecture time to make that basic point.
NUK

Yeah, I read your blog this morning.


Thanx for d info!

Tell me NUK how secure am I with my ZoneAlarmSecurity Suite (AV+FW) AdAware and Kaspersky Antivirus Pro ?

First, I didn't make you read my blog to get the security info:) Next time, you will have to or get NUKed:)

You are more secure using what you are than not using anything, obviously. I wonder why you are using two antivirus progs and two spyware remover progs though? They usually don't play well together and I don't think you gain from throwing a bunch of different progs at the problem. Keeping it simple will make your life easier because you'll know the programs better and be able to use them effectively. I think you have too much *stuff* right now.

I would simplify and ditch ZoneAlarm. Replace it with Agnitum for the firewall and use Ad-Aware for the spyware. Also get the free Spybot and use its *immunize* feature to pro-actively stop some of the more widely-known spyware and malware. Yeah, I know that's two progs for spyware but I think Ad-aware and SPybot are perfect for each other because each has weaknesses that the other corrects. It also has a scheduler for scanning. Kaspersky is very good in my opinion, definitely way above Norton or Macafee.
NUK

I also really like webroot spy sweeper

http://www.webroot.com/products/spysweeper-indepth/

It runs in your system tray just like your antivirus scanner and it protects you from spyware before you get infected. I showedit to my friend who runs a computer repair business in San Diego and he said it finds more spyware than any other program he's ever used. No spyware program finds 100% of all the spyware out there though, so it's good to combine this with the stuff NUK suggested such as Ad-Aware and spybot. I use all three.

I like the Avast Firewall + Antivirus Scanner. Its free and kinda kewl.

ok... got the tunneler & the SSL bar... not sure what I got LOL. After I downloaded & clicked Start Tunneler .. I got a Warning from Norton '05 saying malisous script & I had to manually allow the script to run... is this normal?

Also... been using Netscape to access I.T. ... is this safe? can I use the tunneler with Netscape?

Lot of questions here, I've been concerned about my security... & now NUK has me paronoid (feel like I've been smokin' some good ....)

damn.... can't use smilies, probably because I turned off Java & Java script... another precaution... do I need it disabled with tunneler?

I just now enabled Java & still can't use smilies, WTF?

So this is what I got so far...

Wind. xp SP2, firewall turned on. DSL Router firewall, Norton'05, Adaware (going for the spybot after this reply), & now the Tunneler.

Any other recommendations?

aaahhh!

What do you say about a router with a hardware firewall?

huh metropipe now is cheap. 10% off if you pay with egold and $12 off when you read the stuffs in there . can anyone please pm me with a referral link.
thanks

Just buy it on your own

i can do that if i want, but i feel it's better to have mmg member get some referral bonus.

Sure wish metropipe's live support was open, like they say they would

My tunneler seems to work ok with 1 or 2 windows open, but if I have 4 or more tabs open, I have to keep restarting it.

Anyone else?

****

Also would like someone's opinion on this:

Which is more secure to access I.T.;

IE with the tunneler or

Netscape without the tunneler

???

IE with the tunneler is much more secure than anything without metropipe:)

Now, with no tunnelling, IE would be last among the big three.
NUK

Almost all routers have built-in firewalls. They are better than nothing obviously, but to get the most out of one of these is to know all about the settings for the firewall and how to change and alter ports. That is beyond the scope for the vast majority of users. These firewalls by default are set to allow/disallow the most common functions only.

Hardware firewalls are not too convenient when you find yourself needing to make a change because you are blocking something you want. With software firewalls, it is pretty simple to make a change on the fly and back. Not with hardware which normally requires the router to have to be reset and your computer(s) too. Hardware firewalls ARE higher security than software firewalls, but most home users do not need to purchase a separate hardware firewall for themselves. Businesses? You had better believe it!
NUK

i'm not able to download through the link they sent to me. it said " the link or url doesnt exist." their live support is offline too.

[quote=Student,Mar 31 2005, 12:12 AM]ok... got the tunneler & the SSL bar... not sure what I got LOL. After I downloaded & clicked Start Tunneler .. I got a Warning from Norton '05 saying malisous script & I had to manually allow the script to run... is this normal?
[/quote]

Yes. Tell Norton to shut up.

[quote]
Also... been using Netscape to access I.T. ... is this safe? can I use the tunneler with Netscape?
[/quote]

Yes you can.

[quote]Lot of questions here, I've been concerned about my security... & now NUK has me paronoid (feel like I've been smokin' some good ....)
[/quote]

Weed:)

[quote]damn.... can't use smilies, probably because I turned off Java & Java script... another precaution... do I need it disabled with tunneler?
[/quote]

It's a good idea to me, though I wouldn't worry about it while reading mmg.

[quote]I just now enabled Java & still can't use smilies, WTF?

So this is what I got so far...

Wind. xp SP2, firewall turned on. DSL Router firewall, Norton'05, Adaware (going for the spybot after this reply), & now the Tunneler.

Any other recommendations?

aaahhh
[/quote]

That pretty much covers it. Now get Roboform:) Remember, FREE.
NUK
!
[right][snapback]203044[/snapback][/right]
[/quote]

Saved by NUK !

Thanks dude..

I have 20 - 30 tabbed windows open all the time and I never have a problem. Way back in November when MMG got hacked (and so did I) I went with MP and have never gone anywhere without it.

I might suggest you check out Trojan Hunter, it's free for 30 days and well worth the price to buy it. I also use Secure-Tunnel on my other PC, it works very good.

One rule I have, if you think you have enough security you probably don't.

MMG did not get hacked. A moderator got his password stolen and the person used his account to delete threads That was all fixed with a backup though.

Do you use programs like Secure-tunnel for all your web surfing or just when sensative information is being used?

I keep my proxy's on all the time for everything. Everywhere you go they are looking to get any information they can get on you.

Gosh, I wonder who that moderator might have been? Hmm. It wouldn't have been at the same time in November would it?
NUK

The way it is setup, it is on non-stop. Might as well leave it that way too unless you use sites that require a specific IP address from you for access. PayPal also has a spazz over its members using tunnelers and likes to temporarily freeze your acct and make you change passwords.
NUK

Tell me NUK how secure is proxy chaining?

Not at all unless you have verified that each proxy is truly anonymous. If you chain 5 and the very first one is NOT anonymous, you are screwed. Not by the site you end up at, but by the proxy that masqueraded and now has your real information. Chaining proxies would also be slower than tolerable. I doubt you could get many sites with timing-out constantly.

All you need is one secure, truly anonymous proxy. Forget the freebies!
NUK

I've been an affiliate with MetroPipe for awhile now, never used it but have had a few sales since I signed up, looks like people are taking security more seriously...

Am deciding to take up on their new offer.... $12 off for reading an evaluation report and 10% off if you purchase with Egold aint that bad...

MP had the deal for a long time now, but you should still get it.

the offer is new to me cause haven't paid much attention to it..

waiting for some funds to reach Egold and will do so..

Nuk, and other guys who have used tunellers..

other than MP and Secure-Tunnel, any other good ones available?

As far as comprehensive, those two are the best known. There are others that are similar services like findnot.com(so-so, can be slow, down), the-cloak.com(very good), anonymizer.com (NOT recommended at all!), Webtunnel by primedius.com(good). Those are the ones except for anonymizer that I have used. Anonymizer.com is US-based and also has quickly cooperated with the feds in the past even without a court order. Forget those wimps! They are who MetroPipe is referring to in their ads about not trusting some anonymous services.
NUK

I was just googling and found some site where services similiar to anonymizer are listed so I ran upon proxify.com I dont know whether to subscribe or not, so I would like to hear your oppinion.

Thanks,
Amy

Thanks Nuk for the detailed info.

I would also like to recommend SpywareBlaster. It works really great with AdAware and SpyBot. Its not a scanner, it permanently blocks bad urls, activex and some other staffs. It has saved me on many occassions. Just one thing, NEVER FORGET to update it regularly.

http://www.javacoolsoftware.com/sbdownload.html

Oh, its also free.

I'd be real hesitant. Being based in New York makes it pretty easy for them to be found when someone would like to see who their customers are and what they have been doing. Accepting major credit cards and Paypal leave quite a trail too.

Reading the site briefly, I got the impression that it's likely geared towards warez pirates and illegal downloads as the *subscription only* sites mentioned sounded like warez and mp3s to me. Maybe it's not and I am mistaken but I don't think I'd use them.

Having never heard of them before and them saying they have been around since 2003 is suspicious too. For all I know, it could be a law enforcement sting.
NUK

I'm gonna sound pretty dumb here but is MSN messenger automatically protected if you have MP running for IE?


--

I don't know how (nor do I care), but all of a sudden my MP started running great!
I can surf safely with that many tabs as well now.



So it's best to stay paranoid.....?


--

Nice article, NUK.

Very interesting thread you've started here, Nuk. Glad to see you recommending Agnitum Outpost - I use it all the time and it works a treat. As for proxies I just use Metropipe - why bother wondering if a free site is really anonymous when you just know with MP you're safe?

Thanks for your oppinion about proxify.com NUK I really appreciate it

anybody know why i can't go to yahoo messenger after installing metropipe tunneler? i already set connection preferences to proxy option as told. when i got in to yahoo messenger, it kinda freeze all the time. once yahoomessenger froze, my IE wont work either so far tunneler work fine with firefox.

anybody uses *nix here? any tips on *nix's security?

Yahoo Messenger uses its own connection settings which by default are set to *no proxy*. Open up Yahoo msger and go to PREFERENCES and then CONNECTION. You'll be able to now get your metro settings into it.

If IE and Yahoo keep spazzing with metro as you try to get msger open, you may have to turn off metro until you can get msger's settings changed.
NUK

How many IP's are available per Metropipe / Secure-Tunnel account?
can server location be selected?

beautiful thread NUK

changing to *nix itself made you to forget about this antivirus scaners, spywhere etc.
Best tip on this issue is never login as 'root' while you access the internet.
make a user with tight restriction ( even not allow him to access the tmp folder) and use that login to access the internet. or in other way, make a user with tight control and assign his user id permission to firefox or the browser u are using ( using chmod) , so it will run with his permission.


if you consider more - scan your system with any insecurity scanner like nessus to find your own security holes
[url]http:// nessus.org[/url]
( windows version of nessus is available so windows users can scan thier own system) , use a scan detector like portsentry, or scanlogd ( scanlogd will write logs in your syslog so you can read it from there itself)

for more hardenning use barstille
http://bastille-linux.sourceforge.net/
installation and documents are described in the site, also It have a good help and manual - simply the best

doing first steps itself, will drive you higher security level than that windows - except anonymous and tunnelling. - sorry i didn't use tunnelling yet , my computer is inaccessable from outer world , as i am its have a ip masquerading but not much anonymous. seems like i should do tunnelling - being anonymous is better option.

hi all

i want to know what is the different between (The MetroPipe Privacy Bar for Firefox)&
the tunneler ???

and i wonder if i install the first one with firefox is making my computer in safe or not??

does (The MetroPipe Privacy Bar for Firefox) bringing to my computer the enough security???



my second question is :

what is the difference between firefox browser &mozilla browser ???

which of them is the best according to the security ??



third:

i use (xp + fierfox+(The MetroPipe Privacy Bar for Firefox)+microsoft anti spyware+adware-se+nortonantivirus2003 plus lastupdates+Outpost Firewall Pro 2.7 free version

is my computer in safe ???or i need other things????

thanks

i use now (xp sp2 updated+adware-se+spybot+trojanhunter+ nortonantivirus2003 plus lastupdates+Outpost Firewall Pro 2.7 free version+firefox browser )

no body answered my questions yet ......

no spy or virus will dare to come near ur computer

thanks

u deserve it

hey nuk, I read the first post of this topic today...i am using IE but after looking on your post i download firefox browser from the link you give in the post.
after installing when i want to open any site in this browser it doesn't works and after some time give me this message "The operation times out when attempting to contact www.sitename.com"
and in my IE it's working well, tell me plz the solution of this problem.